full-disclosure - Re: Is_it_OK_to_hold_credit_card_numbers_ in_cookies?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20121016094317.F3C3C3F50@mail2.intranet.rocon-it.de>
Date: Tue, 16 Oct 2012 11:43:17 +0200 (CEST)
From: Christian Rost <christian.rost@...on-it.de>
To: Alexander Georgiev <alexander.georgiev@...oo.de>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Is_it_OK_to_hold_credit_card_numbers_
	in_cookies?_Santander?

Well,

you're right because the process sounds antiquated, but for them it's the most trustworthy way and they seem to fulfill their security policy. 

Every step like official announcements, bank statements or password changes that can not be displayed within the banking-portal, must use another (trustworthy) media. This can be snail mail, Post-Ident or in your turn you have to appear at their office.

Cheers,

Christian
===========================================================
Dipl.-Ing. Christian Rost [T.I.S.P.]
roCon - Informationstechnologie
Ulmenstraße 45

44534 Lünen

fon: +49 (0) 2306 910 658
fax: +49 (0) 2306 910 664
url: http://www.rocon-it.de


--------Alexander Georgiev &lt;alexander.georgiev@...oo.de&gt; wrote--------
Subject: Re: [Full-disclosure] Is_it_OK_to_hold_credit_card_numbers_ in_cookies?_Santander?
Date: 16.10.2012 11:05

>Well, if we talk about Banks...
>
>Hypo Vereinsbank (http://en.wikipedia.org/wiki/HypoVereinsbank) has
>kind of a strange security style: The online banking website will
>disable your login once you enter it 3 times wrong. Your login is your
>BANK ACCOUNT NUMBER. To re-enable it you have to go into one of their
>offices IN PERSON and identify yourself by ID card and then they will
>send your new password BY LETTER (not email).
>
>Now, PLEASE, when you go to their online banking site and run your
>one_script_to_block_them_all.py or whatever, PLEASE, skip my bank
>account, ok?
>
>Banking regards,
>
>Alex
>
>
>
>On Mon, 15 Oct 2012 21:10:47 +0200, Rainer Duffner
><rainer@...ra-secure.de> wrote:
>> Am 14.10.2012 um 17:15 schrieb auto62098873@...hmail.com:
>> 
>>> Santander are a joke when it comes to security. Fed up of two years of
>battling with them to fix issues any other bank would have fixed in
>seconds, things like XSS on login pages etc. Time to hit full disclosure
>with some of these issues in the hope they'll change their game and start
>to take their customers security seriously:
>> 
>> 
>> I had to chuckle.
>> The Spanish banks gave 100% mortgages to people who could just barely
>> finance the interest at ultra-low rates.
>> Now, they're taking back those houses and flats, evicting the owners
>> (who can no longer pay) and putting them into rented apartments (for
>> slightly less than the interest rates).
>> The banks were bailed-out by the government, which has now got to be
>> bailed-out by the EU.
>> 
>> Do you honestly think that "customers" actually exist on the radar of
>> those banks?
>> Hell - who needs customers, when you can have a bail-out?
>> 
>> 
>> 
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/